{"record":{"id":"94de3a613c00c9c8","repo":"crowdsecurity/crowdsec","slug":"while-looking-up-current-user-sid-w","errorCode":null,"errorMessage":"while looking up current user sid: %w","messagePattern":"while looking up current user sid: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csplugin/utils_windows.go","lineNumber":79,"sourceCode":"\tsystemSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinLocalSystemSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating SYSTEM well known sid: %w\", err)\n\t}\n\n\tadminSid, err := windows.CreateWellKnownSid(windows.WELL_KNOWN_SID_TYPE(windows.WinBuiltinAdministratorsSid))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating built-in Administrators well known sid: %w\", err)\n\t}\n\n\tcurrentUser, err := user.Current()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting current user: %w\", err)\n\t}\n\n\tcurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\n\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n\t}\n\n\tsd, err := windows.GetNamedSecurityInfo(path, windows.SE_FILE_OBJECT, windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner security info: %w\", err)\n\t}\n\tif !sd.IsValid() {\n\t\treturn errors.New(\"security descriptor is invalid\")\n\t}\n\towner, _, err := sd.Owner()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting owner: %w\", err)\n\t}\n\tif !owner.IsValid() {\n\t\treturn errors.New(\"owner is invalid\")\n\t}\n\n\tif !owner.Equals(systemSid) && !owner.Equals(currentUserSid) && !owner.Equals(adminSid) {","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csplugin/utils_windows.go#L61-L97","documentation":"After resolving the current user, CheckPerms translates the username into a SID with windows.LookupSID(\"\", currentUser.Username) so it can compare against the plugin's owner SID. This error wraps LookupSID failure, meaning the local security account database could not resolve the given account name to a SID.","triggerScenarios":"Calling CheckPerms when windows.LookupSID cannot resolve currentUser.Username — e.g. the account name is in a format LookupSid can't resolve against the local system, the account was deleted/renamed after the process started, or the account is a domain account and the domain controller is unreachable while no local resolution exists.","commonSituations":"Running crowdsec under a domain service account while disconnected from the domain; running as a virtual/machine account (gMSA) whose name doesn't resolve via LookupAccountName; unusual username formats (UPN vs SAM name) returned by user.Current().","solutions":["Verify the account running crowdsec still exists and its name resolves locally (`whoami /user`)","Run crowdsec under a local account instead of a domain/managed service account if the domain is unreachable","Convert the username to a SID via the process token (windows.OpenProcessToken + GetTokenUser) instead of name-based LookupSID","Read the wrapped %w error to confirm whether it's account-not-found vs. trust/domain failure"],"exampleFix":"// before\ncurrentUserSid, _, _, err := windows.LookupSID(\"\", currentUser.Username)\nif err != nil {\n\treturn fmt.Errorf(\"while looking up current user sid: %w\", err)\n}\n// after\n// Resolve SID from the process token instead of the name\nvar tok windows.Token\nif err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_QUERY, &tok); err == nil {\n\ttokUser, err := tok.GetTokenUser()\n\tif err == nil {\n\t\tcurrentUserSid = tokUser.User.Sid\n\t}\n\ttok.Close()\n}","handlingStrategy":"try-catch","validationCode":"u, err := user.Current()\nif err == nil {\n\tif _, _, _, lookupErr := windows.LookupSID(\"\", u.Username); lookupErr != nil {\n\t\treturn fmt.Errorf(\"cannot resolve SID for %q: %w\", u.Username, lookupErr)\n\t}\n}","typeGuard":null,"tryCatchPattern":"err := CheckPerms(pluginPath)\nif err != nil {\n\tif strings.Contains(err.Error(), \"looking up current user sid\") {\n\t\tlog.Warnf(\"SID lookup failed (domain account offline?): %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Prefer local accounts or ensure domain controllers are reachable for domain service accounts","Resolve the SID from the process token rather than the username when feasible","Test `whoami /user` as the service account before deployment"],"tags":["windows","sid","user","security"],"backgroundTag":"user-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}